/**
 * routes/pairing.ts
 *
 * Handlers for the `pairing.tokens.*` verbs over the PairingTokenManager. Thin
 * verb registration in the same `catalog.register(descriptor, handler)` pattern
 * push.* / fleet.* use, reached through the generic
 * `/api/control-plane/methods/{id}/invoke` endpoint.
 *
 * These verbs manage the daemon's own paired-device tokens, so they require an
 * authenticated operator principal (the invoke layer already gates on the
 * write:/read:control-plane scopes the descriptors declare); the secret is
 * returned only by mint/migrate, and only once.
 */
import type { GatewayMethodCatalog } from '../method-catalog.js';
import type { PairingTokenManager } from '../../pairing/pairing-token-store.js';
/** The narrow slice of PairingTokenManager these verbs need. */
export type PairingGatewayService = Pick<PairingTokenManager, 'list' | 'mint' | 'mintForMigration' | 'rename' | 'revoke' | 'isLegacyRevoked' | 'revokeLegacyShared'>;
/**
 * Attach the `pairing.tokens.*` handlers to their cataloged descriptors. A
 * missing descriptor is a silent no-op rather than a throw, construction must
 * never fail because one verb failed to register; the operator-contract gates
 * catch a real drift.
 */
export declare function registerPairingGatewayMethods(catalog: GatewayMethodCatalog, service: PairingGatewayService): void;
//# sourceMappingURL=pairing.d.ts.map